GitLab 10.0 balli muhim RCE zaifligini tuzatdi — autentifikatsiyasiz masofaviy kod bajarish mumkin

GitLab ta'sirlangan serverlarda autentifikatsiyasiz hujumchilarga ixtiyoriy kodni bajarishga imkon beradigan muhim masofaviy kod bajarish zaifligini bartaraf etish uchun shoshilinch xavfsizlik yangilanishlarini e'lon qildi.

CVE-2026-110264 sifatida kuzatiladigan bu zaiflik maksimal CVSS balli 10.0 ga ega va GitLab Community Edition hamda Enterprise Edition'ga ta'sir qiladi.

Kompaniya 2026-yil 21-oktabrda yamoqlarni e'lon qilib, o'z-o'zini boshqaradigan o'rnatishlar ma'murlarini zudlik bilan yangilashga chaqirdi.

Zaiflik muntazam ifoda kompilyatoridagi butun son to'lib ketishi (integer overflow) natijasida yuzaga keladi, u maxsus tayyorlangan muntazam ifodani qayta ishlaganda sodir bo'ladi. GitLab ma'lum qilishicha, ma'lum sharoitlarda bu zaiflikni ekspluatatsiya qilish server tomonida ixtiyoriy kod bajarishga imkon berishi mumkin.

Ushbu zaiflikning CVSS vektori (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) tarmoq orqali kirish mumkin bo'lgan, huquq yoki foydalanuvchi o'zaro ta'sirini talab qilmaydigan, past hujum murakkabligiga ega va maxfiylik, yaxlitlik hamda mavjudlikka yuqori ta'sir ko'rsatadigan hujumni tasvirlaydi.

Ta'sirlangan versiyalar diapazoni GitLab 7.0 versiyasigacha cho'ziladi, bu esa muammoni ham uzoq muddatli o'rnatishlar, ham yaqinda o'rnatilgan tizimlar uchun dolzarb qiladi.

Tuzatilgan versiyalar: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3 va 19.5.1. GitLab RCE tuzatishini standart yamoq relizlaridan tashqari to'rtta eski reliz tarmog'iga ham orqaga moslashtirgan (backport qilgan).

Zaiflik tadqiqotchi joaxcar tomonidan kompaniyaning HackerOne xato mukofot dasturi orqali xabar qilingan.

GitLab shuningdek o'z-o'zini boshqaradigan mijozlar uchun ikkita tahdid aniqlashni e'lon qildi: "Onigmo native worker crash" va "Org mode render error burst".

Ushbu aniqlashlar potentsial ekspluatatsiya urinishlarini tekshirishni qo'llab-quvvatlash uchun mo'ljallangan. Biroq, maslahatda ekspluatatsiyaning yovvoyi tabiatda sodir bo'lganligi ko'rsatilmagan va aniqlash yo'riqnomasi faol kampaniyaning tasdig'i sifatida talqin qilinmasligi kerak.

Umuman olganda, reliz o'n ikkita zaiflikni, jumladan ikkita yuqori jiddiylikdagi zaiflikni tuzatadi. CVE-2026-15723 (8.2 ball) autentifikatsiyalangan hujumchiga OmniAuth SAML va LDAP avtomatik bog'lash (auto-linking) ikkalasi yoqilganda LDAP bilan bog'langan mavjud hisobni egallab olishga imkon berishi mumkin.

Bu muammo identifikatsiya bog'lash uchun ishlatiladigan LDAP elektron pochta qidiruvidagi noto'g'ri kirish sanitatsiyasidan kelib chiqadi va maqsadli hisob egasining o'zaro ta'sirini talab qilmaydi.

CVE-2026-112212 (7.5 ball) OAuth/OIDC kashf qilish (discovery) nuqtalaridagi kesh zaharlanishi (cache poisoning) bilan bog'liq. Ma'lum sharoitlarda autentifikatsiyasiz hujumchi umumiy kashf hujjatini manipulyatsiya qilib, ma'lum oqimlarni tashqi nazorat qilinadigan serverga yo'naltirishi mumkin.

Ushbu relizdagi boshqa tuzatishlar GraphQL token cheklovlari, identifikator provayderi a'zolik qulflari, ichki ma'lumotlar ochilishi, shaxsiy bosqich metama'lumotlari oshkor bo'lishi, AI obuna tekshiruvlari, maxfiy masala sarlavhalari, tasdiqlash siyosatlari, zaiflik yozuvlari va ma'muriy AI nazoratlari bilan bog'liq muammolarni hal qiladi.

GitLab.com allaqachon tuzatilgan versiyada ishlamoqda. 19.3.5-internal0 va 19.4.2-internal0 yoki undan keyingi versiyalardan foydalanadigan GitLab Dedicated ijarachilari allaqachon ushbu tuzatishlarni o'z ichiga oladi va maslahatga ko'ra qo'shimcha harakat talab qilmaydi.

O'z-o'zini boshqaradigan ma'murlar keng orqaga moslashtirilgan RCE tuzatishini boshqa zaifliklardan ajratib olishlari kerak, chunki ro'yxatdagi tuzatilgan tarmoqlar 19.3.6, 19.4.3 va 19.5.1 versiyalaridan boshlanadi.

Ma'murlar o'rnatish jarayonida ma'lumotlar bazasi migratsiyalarini ham hisobga olishlari kerak. 19.3.6 va 19.4.3 versiyalari odatiy migratsiyalarni o'z ichiga oladi, 19.4.3 versiyasi esa qo'shimcha ravishda o'rnatishdan keyingi migratsiyalarni ham o'z ichiga oladi.

GitLab ogohlantirishicha, bitta tugunli yangilanishlar ushbu migratsiyalar tugaguncha ishlamay qolishni talab qiladi; biroq, to'g'ri bajarilgan nol-to'xtash (zero-downtime) protseduralari ko'p tugunli muhitlarda uzilishlardan qochishi mumkin. Batafsil zaiflik masalalari tuzatishlarni o'z ichiga olgan relizdan keyin to'qson kun o'tgach ommaga ochilishi rejalashtirilgan.

Barcha CVE tafsilotlari

GitLab has released emergency security updates to address a critical remote code execution vulnerabilitythat could allow unauthenticated attackers to execute arbitrary code on affected servers.

This flaw, tracked as CVE-2026-110264, carries the maximum CVSS score of 10.0 and affects both GitLab Community Edition and Enterprise Edition.

The company published the patches on October 21, 2026, urging administrators of self-managed installations to upgrade immediately.

The vulnerability stems from an integer overflow in the regular expression compiler when it processes a specially crafted regular expression. GitLab states that, under certain conditions, exploiting this vulnerability could enable arbitrary server-side code execution.

The CVSS vector for this vulnerability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes a network-accessible attack that requires neither privileges nor user interaction, features low attack complexity, and has high impacts on confidentiality, integrity, and availability.

The affected release range extends back to GitLab version 7.0, making the issue relevant to both longstanding deployments and recent installations.

The fixed releases are versions 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. GitLab has backported the RCE correction to four older release branches in addition to its standard patch releases.

The vulnerability was reported by researcher joaxcar through the company’s HackerOne bug bounty program.

GitLab also published two threat detections for self-managed customers: “Onigmo native worker crash” and “Org mode render error burst.”

These detections are intended to support investigations into potential exploitation attempts. However, the advisory does not indicate that exploitation has occurred in the wild, and detection guidance should not be interpreted as confirmation of an active campaign.

In total, the release addresses twelve vulnerabilities, including two high-severity weaknesses. CVE-2026-15723, rated 8.2, could allow an authenticated attacker to take over an existing LDAP-backed account when both OmniAuth SAML and LDAP auto-linking are enabled.

This issue stems from improper input sanitization during the LDAP email lookup used for identity linking, without requiring interaction from the targeted account holder.

CVE-2026-112212, rated 7.5, concerns cache poisoning in OAuth/OIDC discovery endpoints. Under certain conditions, an unauthenticated attacker could manipulate a shared discovery document and redirect certain flows to an externally controlled server.

Other fixes included in this release address issues related to GraphQL token restrictions, identity-provider membership locks, internal credential exposure, private milestone metadata disclosure, AI subscription checks, confidential issue titles, approval policies, vulnerability records, and administrative AI controls.

GitLab.com is already running the patched version. GitLab Dedicated tenants using versions 19.3.5-internal0 and 19.4.2-internal0 or later already include these fixes and require no further action, according to the advisory.

Self-managed administrators should distinguish the broadly backported RCE fix from the other vulnerabilities, as the listed corrected branches begin at versions 19.3.6, 19.4.3, and 19.5.1.

Administrators must also consider database migrations during deployment. Versions 19.3.6 and 19.4.3 include regular migrations, while version 19.4.3 additionally includes post-deployment migrations.

GitLab warns that single-node upgrades require downtime while these migrations are completed; however, properly executed zero-downtime procedures can avoid disruptions in multi-node environments. Detailed vulnerability issues are scheduled to become public ninety days after the release containing their fixes.

All CVE Details

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.